Access-list in PIX 506E

[jclim]

Dear All,

I would like to block a single IP in the LAN (inside network )to access to the Internet. The following is the configuration

access-list inside_access_in deny tcp host 192.168.1.247 any

access-list inside_access_in permit tcp any any

access-group inside_access_in in interface inside

But instead on one IP address the access-list has block the entire LAN to access the Internet

Kindly advise what is wrong with the configuration.

Thank you

JC

[pkhatri]

Hi JC,

Change the access-list to:

access-list inside_access_in deny ip host 192.168.1.247 any

access-list inside_access_in permit ip any any

You blocked all non-TCP with your initial config. This would have blocked DNS and nothing much would have worked.

Hope that helps - pls rate posts that help.

Regards,

Paresh

[jclim]

Hi Raresh,

It's working now

TQ

JC